A FIREWALL primarily

1. FIREWALL: a network security device or software that ENFORCES a security policy on incoming/outgoing traffic. 2. RULES typically based on: source/dest IP, port, protocol, application, time of day, user identity. 3. TYPES: • STATEFUL: tracks connections allows return traffic for outbound connections automatically. • PROXY: terminates the connection, opens a new one to the destination (inspecting in between). • NEXT-GENERATION (NGFW): adds DPI (deep packet inspection), IDS/IPS integration, app awareness. 4. NOT a complete defense: blocks unauthorised traffic but can't protect against malicious traffic on allowed ports. _Source: NIST SP 800-12 (Firewalls overview)._